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REMARKS/ARGUMENTS 

This Amendment is in response to the Final Office Action mailed October 14, 
2008. Claims 1 and 3-12 were pending in the present application. This Amendment adds new 
claims 13 and 14, leaving pending in the application claims 1 and 3-14. Applicants submit that 
no new matter has been introduced by virtue of these amendments. Reconsideration of the 
rejected claims is respectfully requested. 

Statutory Double Patenting Rejection of Claim 1 

Claim 1 is provisionally rejected under 35 U.S.C. §101 as claiming the same 
invention as that of claim 1 of co-pending U.S. Patent Application No. 10/946,146 (hereinafter 
"the '146 application"), filed September 20, 2004. Applicants respectfully traverse the rejection. 

Per the MPEP: 

In determining whether a statutory basis for a double palenting rejection exists, 
the question to be asked is: Is ihe same invention hcin« claimed Uvicc? 35 U.S.C . KM prevents 
two patents from issuing on the same invention . "Same invention" means i dentical subject matter . 
Miller v. Eagle Mfg. Co., 151 U.S. 186 (1984); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 
1970); and In re Ockert, 245 F.2d 467, 1 14 USPQ 330 (CCPA 1957). 
(MPEP §804(II)(A); emphasis added). 
In the present case, Applicants submit that the claims in question (claim 1 of the 
present application and claim 1 of the '146 application) recite substantially different features , and 
thus cannot be considered the same invention under Section 101 . 

For example, claim 1 of the present application recites, in part: "creat[ing] a 
report identifying at least one employee in the set of employees that is simultaneously assigned 
to business functions that are identified as incompatible as per the at least one business function 
incompatibility." Applicants submit that the specific feature of creating a report identifying 
employees simultaneously assigned to incompatible business functions is not recited in claim 1 
of the '146 application. 

Further, claim 1 of the ' 146 application recites, in part: "creat[ing] an alert 
identifying at least one risk with respect to the operations of the enterprise, wherein the at least 
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one risk is associated with a business function incompatibility in the compatibility registry. . ." 
Applicants submit that the specific feature of creating an alert identifying a risk with respect to 
the operations of an enterprise, where the risk is associated with a business function 
incompatibility is not recited in claim 1 of the present application. 

Since claim 1 of the present application recites features that are not recited in 
claim 1 of the ' 146 application (and vice versa), Applicants submit that the statutory double 
patenting rejection of claim 1 is in error. Accordingly, Applicants respectfully request that the 
rejection be withdrawn. 

35 U.S.C. §112 Rejection of Claims 1 and 3-12 

Claims 1 and 3-12 are rejected under 35 U.S.C. §1 12, first paragraph, as failing to 
comply with the written description requirement. In particular, the Office Action asserts: 
The claim(s) contains subject matter which was not described in the 
specification in such a way as to reasonable convey to one skilled in the relevant art that the 
inventor(s), at the time the application was filed, had possession of the claimed invention. . . 

The added material which is not supported by the original disclosure is as 

follows: 

i. The newly recited claim limitation in Claim 1 "... a storage component 
configured to store . . ." appears to constitute new matter. 

ii. The newly recited claim limitation in Claim 1 ". . . create a report identifying 
at least one employee 'in the set of employees' that is simultaneously assigned to business 
functions that are identified as incompatible as per the at least one business function 
incompatibility . . ." appears to constitute new matter. 

iii. The newly recited claim limitation in Claim 1 ". . . simultaneously 
assigned. . ." appears to constitute new matter. 

iv. The newly recited claim limitation in Claims 1 and 4 ". . . in the set of 
employees . . ." appears to constitute new matter. 

(Office Action: pg. 3; emphasis in original). 
Applicants respectfully traverse the rejection. 

With respect to (i), support may be found in the Specification at, for example, 
paragraph 19 and FIG. 1 . With respect to (ii) and (iii), support may be found in the Specification 
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at, for example, paragraphs 1 18-120. With respect to (iv), support may be found in the 
Specification at, for example, paragraph 120. 

Accordingly, Applicants respectfully request that the Section 1 12 rejection of 
these claims be withdrawn. 

35 U.S.C. $101 Rejection of Claim 1 

Claim 1 is rejected under 35 U.S.C. §101 as being directed to non-statutory 
subject matter. In particular, the Office Action asserts: 

The aforementioned claim is directed toward providing information in relation 
to an electronic communication device via a data signal. However, under the current guidelines of 
35 USC 101, computer software must be tangibly embodied on a computer readable medium, and, 
when executed by a computer processor, perform the steps of the software. In its broadest 
reasonable inteipretation and in light of the specification, claim 1 as recited can be interpreted to 
be embodied on abstract mediums such as carrier waves and signals, and therefore not eligible for 
patent protection. 

(Office Action: pg. 4; emphasis in original). 
Applicants respectfully traverse the rejection. 

As best understood, the Office Action construes Applicants' claim 1 as 
corresponding to computer software per se. This is incorrect. As clearly recited, claim 1 is 
directed to an audit system comprising structural components such as a storage component and a 
processing component. An example of such an audit system (and its components) is described in 
the Specification at, for example, paragraphs 15-21 and FIG. 1. 

Since claim 1 is directed to a physical system rather than software, Applicants 
submit that claim 1 recites statutory subject matter and respectfully requests that the Section 101 
rejection of this claim be withdrawn. 

35 U.S.C. $103 Rejection of Claims 1 and 8-12 

Claims 1 and 8-12 are rejected under 35 U.S.C. § 103(a) as being unpatentable 
over Wefers et al. (International Publication No. WO 2005/055098, hereinafter "Wefers") in 
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view of Kahn (U.S. Patent No. 7,185,192, hereinafter "Kahn"), and in further view of Paulus et 
al. (U.S. Patent No. 7,246,137, hereinafter "Paulus"). Applicants respectfully traverse the 
rejection. 

Applicants' independent claim 1 recites: 
An audit system comprising: 
a storage component configured to store: 

a set of business processes describing the operations of an enterprise, 
each business process including one or more business functions, each business function being 
assigned to one or more employees in a set of employees; and 

a compatibility registry including a set of business function 
incompatibilities, each business function incompatibility identifying at least two business 
I unctions thai should not be simultaneously assigned to a single employee ; and 

at least one processing component in communication with the storage 
component, the at least one processing component being configured to: 

compare at least one business function incompatibility in the 
compatibility registry with the business functions assigned to each employee in the set of 
employees ; and 

create a report identifying at least one employee in the set of employees 
that is simultaneously assigned to business functions that are identified as incompatible as per the 
at least one business function incompatibility. 

(Applicants' independent claim 1, emphasis added). 
Applicants respectfully submit that the features of claim 1 are not taught or 
suggested by Wefers, Kahn, or Paulus, considered individually or in combination. 

For example, Wefers, Kahn, and Paulus fail to teach or suggest "a storage 
component configured to store: ... a compatibility registry including a set of business function 
incompatibilities, each business function incompatibility identifying at least two business 
functions that should not be simultaneously assigned to a single employee" as recited in claim 1 
The Office Action does not identify any section of Wefers or Paulus that teaches this feature. 
However, the Office Action asserts that this feature is shown in Kahn at paragraph 15. (Office 
Action: pg. 8). Applicants respectfully disagree. 

The cited section of Kahn states: 
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The invention is based in part on the observation that most computing system 
environments allow a single user to act in different roles. Some users may require limited access to 
various computing system resources at certain times, while the same or other users might require 
more involved or more open access to resources at the same or at different times. A user may be 
acting in a role (e.g., as a payroll database administrator) on a computer system that conflicts with 
the access control permissions of other roles that the same, or a different user, is able to act in 
(e.g., as an employee). As a simple example, as an employee, a user should not be able to access 
payroll data in certain manners (e.g., read or modify) for security reasons, but as an administrator 
of the payroll database, the user's job may be to maintain (e.g., backup, copy, establish a mirror 
copy, etc., but not specifically change or even read) data within the payroll database, including 
data related to that or another users salary, bonus, and the like. It should be clear that a conflict of 
interest arises in this situation since only limited access to the data might be required. The 
invention helps to impose proper access control and authorization mechanisms in such a scenario. 
(Kahn: col. 11, lines 24-44). 
As can be seen, this section merely makes the general observation that a conflict 
of interest may arise when a user acting in one role (e.g., payroll database administrator) has 
access to certain resources (e.g., read/write privilege for payroll information) that he/she should 
not have access to when acting in different role (e.g., employee). Nowhere does this section (or 
any section) of Kahn make any reference to the specific concept of storing a registry of business 
function incompatibilities as recited in Applicants' claim 1. Further, nowhere does Kahn 
indicate that such a registry would be necessary to implement the invention described therein. 
Accordingly, Kahn fails to teach or suggest "a storage component configured to store: ... a 
compatibility registry including a set of business function incompatibilities, each business 
function incompatibility identifying at least two business functions that should not be 
simultaneously assigned to a single employee" as recited in claim 1 . 

Further, Wefers, Kahn, and Paulus fail to teach or suggest "at least one processing 
component being configured to:. . . compare at least one business function incompatibility in the 
compatibility registry with the business functions assigned to each employee in the set of 
employees" as recited in claim 1 . The Office Action does not identify any section of Kahn or 
Paulus that teaches this feature. However, the Office Action asserts that this feature is shown in 
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Wefers at claim 8 and paragraphs 65-69. (Office Action: pgs. 7-8). Applicants respectfully 
disagree. 

As an initial matter, Applicants note that the two sections of Wefers cited in the 
Office Action (claim 8 and paragraphs 65-69) appear to be unrelated. Claim 8 of Wefers recites 
"wherein the software performs processes for determining whether any tasks assigned to a given 
role has been uniquely assigned to another role." In contrast, paragraphs 65-69 of Wefers 
describe a exemplary "business process catalog" (e.g., 500 of FIG. 5 of Wefers) and exemplary 
relationships between business processes in a central catalog and financial statement accounts 
associated with an organization. Accordingly, it is unclear which section the Office Action is 
relying on to teach the "compare at least one business function incompatibility. . ." feature of 
Applicants' claim 1. 

To the extent that the Office Action relies on claim 8 of Wefers, Applicants 
submit that determining whether a task assigned to a role has been uniquely assigned to another 
role (as recited in claim 8 of Wefers) is substantially different from comparing a business 
function incompatibility stored in the compatibility registry with business functions assigned to 
each employee in a set of employees (as recited in Applicants' claim 1). For example, claim 8 of 
Wefers merely refers to a "task"; the general notion of a task cannot be properly construed as 
teaching or suggesting a business function incompatibility , which identifies at least two business 
functions that should not be simultaneously assigned to a single employee as recited in 
Applicants' claim 1 . Accordingly, the act of determining whether a task is assigned to two 
different roles cannot be properly construed as teaching or suggesting "at least one processing 
component being configured to:. . . compare at least one business function incompatibility in the 
compatibility registry with the business functions assigned to each employee in the set of 
employees " as recited in Applicants' claim 1. (Emphasis added). 

For at least the foregoing reasons, even if Wefers, Kahn, and Paulus were 
combined (although there appears to be no rationale for combining), the resultant combination 
would not teach or suggest all of the features of claim 1 . Accordingly, Applicants submit that 
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claim 1 is allowable over Wefers, Kahn, and Paulus, and respectfully request that the rejection of 
claim 1 be withdrawn. 

Claims 8-12 depend (either directly or indirectly) from independent claim 1, and 
are thus believed to be allowable for at least a similar rationale as discussed for claim 1, and 
others. 

35 U.S.C. $103 Rejection of Claim 3 

Claim 3 is rejected under 35 U.S.C. § 103(a) as being unpatentable over Wefers, 
Kahn, and Paulus as applied to claim 1, and in further view of Morinville (U.S. Patent No. 
7,185,010, hereinafter "Morinville"). Applicants respectfully traverse the rejection. 

Claim 3 depends from independent claim 1 , which is not rendered obvious by 
Wefers, Kahn, and Paulus as described above. As best understood, Morinville does not provide 
any teaching that would remedy the deficiencies of Wefers, Kahn, and Paulus in this regard. 
Thus, even if Wefers, Kahn, Paulus, and Morinville were combined (although there appears to be 
no rationale for combining), the resultant combination would not teach or suggest all of the 
features of claim 3. Accordingly, Applicants submit that claim 3 is allowable over Wefers, 
Kahn, Paulus, and Morinville, and respectfully request that the rejection of claim 3 be 
withdrawn. 

35 U.S.C. $103 Rejection of Claims 4-7 

Claims 4-7 are rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Wefers, Kahn, and Paulus as applied to claim l,and in further view Morinville and Homsi (U.S. 
Patent No. 7,373,310, hereinafter "Homsi"). Applicants respectfully traverse the rejection. 

Claims 4-7 depend from independent claim 1, which are not rendered obvious by 
Wefers, Kahn, and Paulus as described above. As best understood, Morinville and Homsi does 
not provide any teaching that would remedy the deficiencies of Wefers, Kahn, and Paulus in this 
regard. Thus, claims 4-7 are allowable for at least a similar rationale as discussed for claim 1 . 
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In addition, Applicants submit that claims 4-7 recite additional features that 
distinguish over the cited art. For example, claim 7 recites, in part "wherein the at least one 
processing component is further configured to receive a selection from an auditor of a business 
process from the business process library and, in response to the selection, add the selected 
business process to the set of business processes describing the operations of the enterprise and 
add at least one business function incompatibility to the compatibility registry." The Office 
Action does not identify any section of Wefers, Kahn, Paulus, or Homsi that teaches these 
features. However, the Office Action asserts that these features are shown in Morinville at 
paragraphs 47-50. (Office Action: pgs. 13-14). Applicants respectfully disagree. 

As best understood, the cited section of Morinville describes a technique for 
extracting data from process audit logs into a data warehouse and then performing data mining 
on the warehouse data to identify patterns across instances of process executions. The cited 
section makes absolutely no reference to, for example, receiving a selection from an auditor of a 
business process in a business process library , or adding the selecting business process to a set of 
business processes defined for an enterprise , or adding a business function incompatibility to a 
compatibility registry . Accordingly, the cited section necessarily fails to teach or suggest 
"wherein the at least one processing component is further configured to receive a selection from 
an auditor of a business process from the business process library and, in response to the 
selection, add the selected business process to the set of business processes describing the 
operations of the enterprise and add at least one business function incompatibility to the 
compatibility registry" as recited in claim 7. 

For at least the foregoing reasons, Applicants submit that claims 4-7 are allowable 
over the cited art, and respectfully request that the rejection of these claims be withdrawn. 

New Claims 13 and 14 

Claims 13 and 14 have been added to cover various embodiments of the present 
invention. Applicants submit that claims 13 and 14 do not introduce any new matter. Merely by 
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way of example, support for the features of claims 13 and 14 may be found in the Specification 
at, for instance, paragraphs 118-119. 

Applicants submit that the features of claims 13 and 14 are not taught or 
suggested by the cited art. For example, claim 13 recites, in part: "receive [ing], from an auditor, 
a selection of a business process from the business process library," "add[ing] the selected 
business process to the set of business processes describing the operations of the enterprise," and 
"add[ing] a business function included in the selected business process and its associated list of 
incompatible business functions to the business function compatibility registry." And claim 14 
recites, in part: "wherein at least one business process in the business process library includes a 
parent business function and a child business function," and "wherein the child business function 
inherits the list of incompatible business functions associated with the parent business function." 
No disclosure pertaining to these features could be found in Wefers, Kahn, Paulus, Morinville, 
and/or Homsi. 

Accordingly, Applicants respectfully submit that claims 13 and 14 are in 
condition for allowance. 

CONCLUSION 

In view of the foregoing, Applicants believe all claims now pending in this 

Application are in condition for allowance and an action to that end is respectfully requested. 

If the Examiner believes a telephone conference would expedite prosecution of 

this application, please telephone the undersigned at 650-326-2400. 

Respectfully submitted, 

/Andrew J. Lee/ 

Andrew J. Lee 
Reg. No. 60,371 

TOWNSEND and TOWNSEND and CREW LLP 

Two Embarcadero Center, Eighth Floor 

San Francisco, California 941 1 1-3834 

Tel: 650-326-2400 

Fax: 415-576-0300 

A2L:m4g 
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